my-blog-personal

[my-blog-personal]

Graylog syslog server on Raspberry Pi 4 (8gb)

This is how I installed graylog on my Pi.

What is needed:

1.- Raspberry Pi 4 - 8 GB Ram with firmware patch to boot from USB.

2.- Geekworm Raspberry Pi 4 mSATA SSD Adapter X857.

3.- MSata drive (using a 250 gb drive).

4.- Raspbian/Debian, Ubuntu aarch64.

5.- Network connection (Ethernet, WiFi and BT disabled).

6.- Rpi4 heatsinks (optional/recommended).

Procedure:

Install OS (Raspbian Aarch64) on the MSata drive, boot the raspberry pi and then do

# sudo apt update && apt full-upgrade -y

# sudo apt install apt-transport-https openjdk-11-jre-headless uuid-runtime pwgen dirmngr gnupg wget zip curl

Install MongoDB

# curl -s https://www.mongodb.org/static/pgp/server-4.2.asc | sudo apt-key add -

# echo "deb [ arch=arm64 ] https://repo.mongodb.org/apt/ubuntu bionic/mongodb-org/4.2 multiverse" | sudo tee /etc/apt/sources.list.d/mongodb-org-4.2.list

# sudo apt update && sudo apt install mongodb-org -y

# sudo systemctl enable mongod

# sudo systemctl start mongod

# sudo systemctl status mongod

Install Elasticsearch

# wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | sudo apt-key add -

# echo "deb [ arch=arm64 ] https://artifacts.elastic.co/packages/oss-7.x/apt stable main" | sudo tee -a /etc/apt/sources.list.d/elastic-7.x.list

# sudo apt update && sudo apt install elasticsearch-oss -y

# sudo tee -a /etc/elasticsearch/elasticsearch.yml > /dev/null <<EOT cluster.name: graylog network.host: 127.0.0.1 http.port: 9200 action.auto_create_index: false EOT

# sudo systemctl daemon-reload

# sudo systemctl enable elasticsearch.service

# sudo systemctl restart elasticsearch.service

Install Graylog

Download the latest graylog-x.x.x.tgz from https://www.graylog.org/downloads-2 and scp it to your PI or

# cd opt

# wget https://downloads.graylog.org/releases/graylog/graylog-x.x.x.tgz

# sudo tar -xf graylog-x.x.x.tgz

# sudo mv /opt/graylog-x.x.x /opt/graylog

# sudo rm graylog-x.x.x.tgz

# vi /etc/graylog/server/server.conf and configure to your needs

To start the server do:

# cd /opt/graylog/bin

# ./graylogctl start

After the server started go to http://server-ip:9000 and use the user admin with the password previously configured, create an input and that should be all.

To configure password and settings on server.conf please refer to graylog documentation.